IDEAInstitute of Digital Excellence & Advertising
Contact
Menu

Legal

Privacy Policy

Draft. This document still contains information to be completed.

Effective date: TODO legal.effective_date — RRRR-MM-DD · Version 1.0

This policy explains what personal data we collect through https://ads.institute, why, on what legal basis, how long we keep it and what rights you have. It fulfils the information obligation under Article 13 GDPR. The Polish version prevails in case of discrepancy.

1. Controller

The controller of your personal data is DIMITRIQX MARKETING Dzmitry Myshko, Podole 61, 05-600 Grójec, Poland, tax ID (NIP) 1132923541, REGON 389519232 ("IDEA", "we").

For anything related to your personal data, email digital@ads.institute or write to the address above. We have not appointed a data protection officer because we are not required to.

2. Purposes, legal bases and retention

Situation Data Purpose Legal basis Retention
You submit the contact form or request an audit name, email, phone, company, job title, website, message replying to the enquiry, preparing an offer or audit Art. 6(1)(b) GDPR (steps at your request before entering into a contract); where you act for a company — Art. 6(1)(f) GDPR (our legitimate interest in contacting a prospective client's representative) 12 miesięcy od ostatniego kontaktu, jeśli nie zawarto umowy
You tick the optional consent to commercial communications in the form name, email, phone (if you give it to us), company, enquiry content; date and time of consent and the version of its wording sending commercial information about IDEA services (offers and follow-up messages after your enquiry) by email and by phone (calls, SMS) Art. 6(1)(a) GDPR (consent) and Art. 398 of the Polish Electronic Communications Law (consent to commercial information and direct marketing) do wycofania zgody; potwierdzenie udzielenia i wycofania zgody przechowujemy 3 lata, aby móc je wykazać
You email us email address, correspondence, data in the message handling correspondence Art. 6(1)(f) GDPR (replying to messages) 12 miesięcy od ostatniego kontaktu, jeśli nie zawarto umowy
You sign a contract with us or are a client's contact person identification and contact data, invoicing data performing the contract Art. 6(1)(b) GDPR; for client contact persons — Art. 6(1)(f) GDPR czas trwania umowy + okres przedawnienia roszczeń (co do zasady 3 lata dla roszczeń związanych z działalnością gospodarczą, art. 118 KC)
Invoicing and accounting invoice data meeting tax and accounting obligations Art. 6(1)(c) GDPR 5 lat od końca roku kalendarzowego, w którym upłynął termin płatności podatku (art. 86 Ordynacji podatkowej)
You consent to analytics cookies cookie identifiers, truncated IP address, device and on-site behaviour data statistics and site improvement Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law 14 miesięcy (ustawienie GA4)
You make a choice in the cookie banner random consent ID, date and time, your choice, banner version, language, page address, truncated IP address (last two octets removed), country, browser type demonstrating that we obtained consent or respected a refusal (consent log, kept once it is connected; until then your choice is stored only in the idea_consent cookie on your device) Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to demonstrate consent) 3 lata od zapisu
You use the website IP address, technical data in server logs security and operation of the site Art. 6(1)(f) GDPR (security) do 30 dni
Establishing or defending claims data relevant to the case establishing, pursuing or defending claims Art. 6(1)(f) GDPR until claims become time-barred

Replying to your enquiry, including the offer you ask for, does not require consent to commercial communications. That consent is a separate, optional checkbox in the form. If you leave it unticked, we will still reply to your enquiry, but we will not send you other offers later.

Where we rely on consent, you can withdraw it at any time: email digital@ads.institute, reply to our message or tell us during a phone call. Withdrawing is as easy as giving consent and does not affect the lawfulness of processing before withdrawal.

3. Do you have to provide data

Providing data is voluntary. Without an email or phone number we cannot reply to your enquiry, and without invoicing data we cannot sign a contract. Consent to commercial communications is optional and is not a condition for a reply or a contract. Optional fields are marked in the form.

4. Recipients

We share data only with providers that help us run the website and the business. They process it on our instructions under a data processing agreement:

Recipient Role Country Transfer safeguard
Cloudflare, Inc. website hosting (Cloudflare Workers), CDN, protection against attacks, form transmission USA / EU EU-US Data Privacy Framework + standard contractual clauses
n8n GmbH (n8n Cloud), Germany receiving form enquiries and automating their handling EU (Germany, hosted in the EU) data stored in the EU
Google Ireland Ltd. (Google Workspace: Gmail, Google Sheets) email, storage of enquiries and correspondence Ireland / USA EU-US Data Privacy Framework + standard contractual clauses
Web INnovative Software Sp. z o.o. (wFirma.pl) issuing invoices and accounting Poland no transfer outside the EEA
Google Ireland Ltd. (Google Analytics 4, Google Tag Manager) visit statistics, only after consent to analytics cookies Ireland / USA EU-US Data Privacy Framework + standard contractual clauses

We use a bank for payments, and tax authorities may receive invoice data. They process it as separate controllers under the law. Other public authorities may also receive data where the law requires it.

We do not share personal data with AI tools (see section 8). The Telegram notification about a new enquiry contains only the enquiry number and no personal data.

5. Transfers outside the EEA

Some providers (Google, Cloudflare) may process data in the USA. Transfers rely on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and additionally on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR) included in these providers' data processing agreements. If another provider's sub-processor handles data outside the EEA, the same rules apply under that provider's data processing agreement. You can request a copy of the safeguards at digital@ads.institute.

Form enquiries are received by n8n Cloud on servers in the EU and stored in Google Workspace (Gmail, Google Sheets). Internal notifications about new enquiries contain no personal data.

6. Your rights

You have the right to:

  1. access your data and receive a copy (Art. 15 GDPR);
  2. rectification (Art. 16 GDPR);
  3. erasure (Art. 17 GDPR);
  4. restriction of processing (Art. 18 GDPR);
  5. data portability for data processed on the basis of consent or contract (Art. 20 GDPR);
  6. withdraw consent at any time, including consent to commercial communications (Art. 7(3) GDPR);
  7. lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the supervisory authority in your EU country.

Right to object (Art. 21 GDPR). Where we process data on the basis of legitimate interest, you may object at any time on grounds relating to your particular situation. We always honour objections to processing for direct marketing, without the need to give reasons (Art. 21(2) and (3) GDPR).

To exercise your rights, email digital@ads.institute. We will respond within one month.

7. Automated decisions and profiling

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

8. AI tools

We may use artificial intelligence tools (e.g. ChatGPT, Claude) to analyse enquiries and prepare offers. We only enter information stripped of personal data: before use, we remove names, email addresses, phone numbers and other details that could identify you. The providers of these tools are therefore not recipients of your personal data. A person reviews and edits every reply and offer prepared with AI. See How We Use AI. We do not use the content of your enquiries to train AI models.

9. Cookies

See our Cookie Policy. You can change your settings at any time via "Cookie settings" in the footer.

10. Children

This website is aimed at businesses and is not intended for anyone under 16. We do not knowingly collect their data.

11. Notice for US residents

This section applies to visitors in the United States, including California (California Online Privacy Protection Act).

  1. Categories of data. We collect the data listed in section 2: contact details, company details, message content, online identifiers and website usage data.
  2. Who we share it with. The categories of recipients are listed in section 4.
  3. How to review and change your data. Email digital@ads.institute. We will respond within 30 days.
  4. Do Not Track. This website does not respond to browser "Do Not Track" signals. Analytics cookies are set only after you consent in the cookie banner.
  5. Sale of data. We do not sell personal information.
  6. Children. This website is not directed at children under 13 (COPPA).
  7. Changes. The effective date is shown at the top of this policy.

12. Changes to this policy

We may update this policy when the law or our tools change. The new version applies from the date shown at the top. We will announce material changes on the website.

Change log

Version Date Change
1.0 TODO legal.effective_date — RRRR-MM-DD First version